Infinite JavaScript Scrolling | "Moar Horses" TJCTF 2018

Key Takeaways

hey YouTube this is another video right up for the challenge more horses for 40 points in a web category of TJ CTF for recent capture the flag competition so the challenge from here is the horse is back and it gives us a web address and web page that we can check out I actually had better luck looking at this in Firefox and honestly true credit and props goes to giggles Emoto because I think he was the one that originally found the lead on this and figured it out because a lot of people struggled with this challenge because it didn't make a whole lot of sense it said scroll down to find the flag it's the regular infinity horse sling where the page would just keep loading and scrolling and you would just see legs in this ASCII picture of the horse over and over and over again there didn't seem to be a whole new gimmick to it there was nothing in the source code nothing on like any HTTP headers it was just nothing there so what he did and what he pointed me to was that you can actually just literally scroll like programmatically scroll cuz you'll see if you set up a network query you'll see the web page will continually get legs like this HTML page over and over and over again and that one will always have the response of okay more HTML legs and hopes you couldn't get the flag that's dumb so what we had done and what giggles had done is we had set up a okay I gotta stop saying we but he I'm showing case and show showcasing you love and then the support that this was totally your challenge so thank you for your everything you do on the team what he'd done it hit set up in a window interval so that every now and again we could just be running a new function over and over and over again to scroll and scroll by lines and I think just a thousand or whatever is fine crazy amount and then we can set it for as as often as we want to just like over and over again create requests and slowly get more legs so you can see the number of requests is going up the scroll bar is increasing because we are getting more and more so each of these HTML responses are normally in size 707 bytes but what if one of them does contain the flag as the only direction that we're told your is to scroll and to keep scrolling maybe at some point one of these will have a different result so the best way we can determine that is to sort by size and this is going to take a little bit of tie I don't honestly know how long it will take but at the very very top since we're sorting by size one of these will return something other than 707 bytes so we'll pause the recording and I'll get back to you when that happens okay it didn't take much long at all just a few seconds after I said that we did get 704 bytes which we can take a look at go ahead and view the response over here in the preview we do have our flag so that challenge was weird in that there wasn't a whole lot of guidance other than just scrolling and you literally had to kind of go with it just buy it and hold your breath hope that you would eventually get there so we can go ahead and say that if we particularly wanted to we could make a directory for more horses and save that flag just in there but that is the solution two more horses is to literally scroll forever until you get a response that is your flag cool hey I want to give a special shout out and some love to people that support me on patreon you guys are fantastic one dollar a month or more on patreon will give you a special shout-out just like this at the end of every video five dollars or more on patreon will give you early access everything that I release on YouTube before it goes live if you did like this video and you want to see more CTF video write-ups or programming tutorials or other stuff that I do please do like comment and subscribe join our discord server link in the description if you another cool community of CCI players hackers and programmers if you want to jam with me or anyone else when we're playing it cool CTF upcoming that's the awesome and best place to do it in hey I would love to see your support on patreon and I hope to see you in the next video thanks